1. Field of the Invention
The invention relates to a data processing device which consists of a plurality of parallel-operating data processing modules and which includes a multiple redundant clock device which consists of clock circuits. Each clock circuit is assigned to a respective data processing module. The clock device also includes an interconnection network for communicating output clock signals between the respective clock circuits. Each clock circuit includes an input majority decision device for determining a majority signal from the output clock signals received. Each clock circuit also includes a clock function generator which includes a readjustment circuit for readjusting the clock function generator according to the majority signal by way of a control function in order to reduce a deviation between the clock function signal and the majority signal. Each clock circuit also includes an output element for forming the output clock signal of the relevant clock circuit from said clock function signal.
2. Prior Art
A data processing device of this kind is known from U.S. Pat. No. 4,402,045. The known device is a so-called (n,k) system, notably a (4, 2) system in which quadruplication of the processor capacity and doubling of the storage capacity (i.e. doubling of the storage capacity per data word) are used in order to ensure that the device remains operational even when one of the data processing modules breaks down. It has been proposed to provide such a data processing device with a multiple redundant clock device (column 11, lines 25-30 of the cited Patent Specification) so that a given failure in the clock device is also permissible.
In this respect reference is made to the article by D. Davies et al: Synchronizing and Matching in Redundant Systems, IEEE Tr. Comp. Vol. C27, No. 6, June 1978, pages 531-539. The clock device shown in FIG. 9 of the cited article includes three clock circuits which receive the output clock signals of all three clock circuits. On mathematical grounds it has been found that such a triplication offers insufficient protection, so that errors can still occur, even when two clock modules operate correctly